Is creating a long password for my coinbase account enough to keep my bitcoins secure?

Question

I've made an account with coinbase and purchased some bitcoin. Only after to start reading people talk about getting hacked and how bitcoins are not secure unless you put them in a "wallet".To be frank this wallet stuff confuses me a bit, I rather just keep it simple and keep the coins directly in the place they go when I buy them, which I guess would be on the "exchange"? So I'm wondering If I create an incredibly long password for my coinbase account, Is this enough security to protect my bitcoins? Just "walletless" and in the hands of coinbase. I realize if coinbase was hacked as a whole , there would be issues since they act as the bank basically. but aside from that is there really any risk leaving my bitcoin on their if I have like lets say a 45 character long password?

Answer 1

The long password will not help that much and is also likely difficult to enter. Much better enable 2 Factor Authentication with Coinbase (https://support.coinbase.com/customer/en/portal/articles/1658338-how-do-i-set-up-2-factor-authentication-) which gives you a second level of control.

If you have the wallet e.g. on the phone you have much more control on your funds and do not depend on the security implementations of Coinbase. Also does Coinbase have limits when moving funds which does not apply to your funds in your local wallet.

Often splitting funds in local and online wallets gives most flexibility and security so your eggs are not all in one basket.

Answer 2

Questions like "is this secure" don't have simple answers. You can't really ever guarantee security, only reduce risks, and any given security technique usually addresses some risks but not others.

Using a very long and strong password will make it difficult for anyone to guess your password by trying a large number of passwords. However, this is probably already fairly difficult, because most websites will lock your account after a relatively small number of failed guesses, or at least slow the attacker's ability to keep guessing. (Note the phrase "strong": a password consisting of the letter a 45 times is long but still not much good.)

It will not help defend against:

• Malicious software on your computer that steals your password as you type it

• People who know you well enough to guess what password you would choose (a randomly generated password avoids this)

• Someone finding where you wrote down or stored your password (which you are more likely to need to do if it is random)

• Rogue employees at Coinbase with administrator access who could steal your password, or steal your coins directly

• Coinbase itself deciding to steal your coins, or being hacked (as you mention), or going bankrupt due to mismanagement or malfeasance

• Phishing attacks that trick you into giving your password to an attacker, thinking they are really Coinbase

• Other people tricking you into giving your coins to them

All of these are realistic threats.

Answer 3

Well the best options are:

1. Use a password with mixed characters (numbers, letters, uppercase, lowercase, etc)
2. Do not use the same password anywhere else
3. Activate 2FA (If you don't have a smartphone, there is a chrome app which facilitates 2FA)
4. Save the 2FA seed to somewhere safe
5. Don't share the password with anyone
6. Lock your phone or use an app which locks the Authenticator app before you give your mobile to anyone else.
7. Do not click or open links shared by unknown people
8. Always check the address bar when you are logging in to coinbase (make sure the address is right)

I can understand if using a wallet nowadays is difficult, but I am optimistic that in a few years, we will have great GUI wallets which will allow even a kid to be able to use it.

Follow the above steps and you will be good to go. Unless ofcourse coinbase gets hacked :D